There are generally three kinds of aviation books:

1. The coffee table book. Will have many beautiful photographs, refuses to fit on any of your shelves and contains zero information useful to anyone who'd wonder what it would be like to actually fly the specific airplanes pictured. So it'll say the maximum speed, but not the takeoff run, which is far more likely to kill you if you get it wrong.

2. The memoir. Antoine de Saint-Exupéry would be representative, and Robert Buck is also good. To modern eyes the things these people tried and got away with are mind boggling. Some memoirs are more personal than others, and none is ever 100% true.

3. The serious technical discussion. Aerodynamics for Naval Aviators is the classic of this genre, and reading it makes you realize just how little is actually covered in a PPL course. The good ones often have elements of memoirs. The 'holy grail' in this category is Ignition!: An Informal History of Liquid Rocket Propellants - the first edition goes for around US$500, if you could find one. It contains many wonderful quotes on the practicalities of working with liquid rocket fuels, including the immortal "For dealing with this situation, I have always recommended a good pair of running shoes.”

The Hush Kit book has somehow managed to "Venn diagram" its way into doing all three of these at once. It's based on the long running and sometimes scatological blog of the same name. If you know someone who flies they will probably like it. It's a wonderful book to dip in and out of.

The other aspect of this that I find interesting is how it was produced. As someone who now spends around half his time producing content, I look at publications very differently than I used to. How many blogs do you know that could actually be used as the basis for a book, never mind one which gets to the #11 ranking in its category in Amazon without the backing of a traditional publisher or celebrity on the part of the author?

The depth and breadth of the content is extraordinary, as is the production quality, and I have to wonder how Joe Coles, the author, managed to herd all the cats needed to get this over the line.

So in conclusion:

This is a great present for the aviation nut in your life, but don't get the Kindle as it's not that sort of book.

If you're a content creator I would argue that thinking about how the content you create would end up as part of a book is an interesting way to decide what to write and what to skip. If you want to become a reliable source or even, God help us, a 'brand', you need to be consistent in what you define your area of wisdom as. Not everything you want to say will fit in with the other content you produce. A second reason for the 'would this work in a book?' test is that it's a simple check for whether something is good enough to publish or not, and one which will influence my writing going forward.

Full Disclosure: I have had work published on HushKit, but I'm not in the book.

This originally appeared in my LinkedIn feed. I’m cross posting it here as LI articles tend to become unfindable, quickly.

Have you ever noticed how we’re always seeing scaling stories?

Ones about how developers were able to spin up a massive cluster of something in 4 minutes flat? Everybody out there assumes they will rapidly become the next FAANG, and need to architect and design accordingly. But most people operate in industries where there are practical limits to how much scale you could possibly need, and even then you’d be unlikely to reach them. And just because one individual system can support that scale does it mean the rest of the business can? I’ve been dealing with massive scale, high volumes and extreme latency expectations for years. The reality of what’s needed to operate at that level is very different, and tends to involve a lot more humans and complexity than the dashboard of your hyperscaler would suggest. Let me give you a very simple example: I used to work in an environment where we had to handle 27 billion incoming records per day, with 10% showing up in ‘busy hour’. During that hour we’d see around 750,000 per second. Impressive eh? But at that scale nothing is simple, or nice, and you generally don’t get to go home on time. Why? Because a one in a billion event is happening every 22 minutes or so, which means lots of humans spend lots of time handling weird edge cases.

But how often do you see stories about how someone saved money?

It’s rare, isn’t it? When we do see it it’s usually couched as ‘efficiency’. It’s very rare to see someone publicly talk about saving money, which is odd, as we live in a world which revolves around the acquisition and safeguarding of the stuff. Why would this be?

In software we have a culture that favors rapid growth and scale over thoughtful development and precision. I think there are two reasons for this:

Developer ego.

The nature of developers is that they are never happy with what exists. It needs to be extended, improved, enhanced. Made scalable. By them. Especially when their boss asked for it! Eventually a developer gets to a stage where they are old enough, wise enough, and have been up at three in the morning enough, to start focusing on the simplest way to make a given problem go away. But don’t hold your breath waiting for this to happen. One role of management ought to be to rein their developers in, but sometimes they seem to be part of the problem. That’s because sometimes they are.

Management incentives.

In a lot of companies your status as a manager is derived from the budget you control and the number of people that report to you. This can create perverse incentives, as hiring more people and spending more money is good for an individual’s career, but may be bad for the enterprise as a whole. Doing more with less is a mug’s game if you are the only one doing it. OK, maybe I’m being cynical…. What I can say is that until recently, once money had been spent very few people had an incentive to question it. This is because before public cloud and subscription licensing software and related hardware was very much a CAPEX item, where it’s now an OPEX item. Let me illustrate this with a brief side quest..

Side Quest: Finding small numbers in Atlanta…

Some years ago, when working for a different employer, I was sent on a plane to Atlanta to do some performance measurements for a very large and important telco charging system we were responsible for. We needed to understand by how much the load could increase before we’d need new hardware. At the busiest time of day, do you know what the CPU loading was?

2%.

The good news was that we had plenty of spare capacity. The bad news was the measured number was so low we had no idea how far it could scale. What had happened was that because we’d never been 100% certain of the hardware requirements, as the spec for the system moved through the corporate chain of command each layer had padded it, as they didn’t want to be blamed for it not being able to handle the workload. So a 3x planned safety margin had turned into a 50x actual safety margin. But this was an age of CAPEX, and all the money had been spent up front. So nobody, anywhere, wanted to dive too deeply into an issue which could only make them look bad.

The shift to OPEX…

Our world has changed, as we now use public cloud or subscription software. But a lot of developers don’t seem to have received the memo. Imagine if the scenario above had taken place last week. The costs would have been visible within 30 days of launch. Would people have been spitting out their coffee in the US and dropping monocles into tea cups in the UK? Maybe. Probably not. Weird, eh? But sooner or later it will become a live issue. And it’s going to change the industry.

We’re at the top of business cycle - what we incentivize will change.

As Jon Snow would say, “Winter is coming!”. In addition to the natural economic cycle peaking, we’re still dealing with the hangover from COVID, not to mention the war in Ukraine or the current POTUS. The rules the industry has lived by have changed. Costs are not just visible, but can be tied to people who created them. Sadly, they are now visible in time for bonus and promotion seasons.

So what’s going to happen?

The term “Business Value Engineering” is suddenly going to become trendy. Some vendors will be pleasantly surprised. Others will be deeply embarrassed, and have to divert significant engineering resources to reduce solution TCO. Note that this will also apply to the Open Source community, as just because the software’s free it doesn’t mean anything else associated with it is. We will also see a shift in emphasis from how easy it is to get started to how easy it is to get finished, and be able to afford the results. Some high performance and high volume systems will migrate off the cloud and back to on-prem because the hyperscaler bills will be shocking and it will be cheaper to host it yourself.

Make no mistake - this shift won’t be free, and will sort out the sheep from the goats. Having spent a lot of time on TCO and benchmarking over the last few years, I can state definitely that it’s not something you can hand wave your way past. A lot of architectural decisions that have been made over the last decade are going to suddenly look ... questionable ... And interview questions for developers will include Net Present Value calculations.

Sometimes smaller is better

I am happy to admit that I am lucky, in that not only do I like airplanes, but my career and life has allowed me to visit some of the best aviation museums in the world, in addition to earning my PPL and skydiving credentials. Going to college in London meant that the RAF Museum in Hendon or IWM Duxford were accessible. In other cases it was part of a long work assignment, such as a summer in Washington DC that meant access to both Smithsonians – the National Air and Space museum on the Mall and the Udvar Hazy museum, in Virginia. Sometimes I plotted and schemed. A work trip to Seattle created an opportunity, thanks to a deliberately convoluted piece of scheduling on my part, to visit the Museum of Flight. Sometimes it was happenstance, such as finding myself overflying Castle Air Museum while learning to fly, as the adjacent airfield (KMER) has a 15,000 foot runway that allows multiple ‘touch and go’s on a single pass.

But when I look back on all this, I realize I’ve often had more fun at the smaller museums. The ones without national backing, or millionaire donors. Why?

The French Fry Factor

Once you get into it there’s a whole series of reasons why this is. But let’s start with fast food. In your local or regional museum, it will smell exactly like your local FBO or flying school. Avgas. Metal. Dodgy 1970’s plastic trim that’s been overheated by the sunlight. The aircraft smell like they are still alive. In a mega museum you’ll be standing in front of some extraordinary piece of aviation history and be surrounded by the smell of fries. Because they have a McDonalds on site. And I’m not against McDonalds, indeed I’m a bit too fond of the place. But if your museum is operating at a scale where it has its own fast-food ecosystem, then the nature of the experience is going to be fundamentally different. It’s not that the people don’t care – they do, but there’s no time to linger because the mega museum has so much stuff. Yes, I know, I’m being churlish. But sometimes there’s real value in being forced to stop and look, because the place isn’t huge, and you can’t spend three hours continuously walking.

For example: It wasn’t until I went to the small Shannon Aviation Museum that I realized the front half of a De Haviland Vampire is made of plywood.

The People You Meet

Then there are the people you meet, like at the the Cradle of Aviation museum on Long Island, where the docent spent a good twenty minutes trying to claim that Lindbergh, who had departed from there, was the first person to fly the Atlantic because, and I quote, “Newfoundland to Ireland doesn’t count. It’s one island to another”. Apparently, Alcock and Brown were wasting their time… But just because you go to a major museum doesn’t mean the docents will be any wiser. While at the Udvar Hazy I noticed a small pool of liquid underneath their Me163. Now, anyone who knows anything about that particular aircraft knows that it was powered by two equally nasty liquids, either of which can kill you and that they explode if they meet each other. While an oil drip is normal in a lot of aircraft, mysterious liquids dripping out of your 163 require closer examination. Actually, scratch that. They require further examination. From about 200 feet away. Through binoculars. I pointed this out to a docent, and they had no idea what the liquid was and didn’t seem concerned even when I pointed out the implications. Their Me163 has yet, as of the time of writing, to explode, but this tells us two things. One: I am slightly paranoid. And Two: Mega museums are so huge and have so many exhibits that the docents could never, even if locked in for weeks like a papal conclave, learn everything a prospective visitor could ask about each and every exhibit.

The ability to get close

Another factor is the physical layout of small museums. Because they don’t have armies of random visitors, not all of whom will behave sensibly, and also because they are usually constrained for space, you can get a lot closer to the exhibits. And their exhibits also tend to include a lot more partially assembled aircraft and miscellaneous components.

Recently I was able to visit the Ulster Aviation Society, near Lisburn. They are an astonishing small museum that you book in advance and then get a 2 hour guided tour as part of a small group. Out of all the exhibits the thing which impacted me the most was a restored rear gunner’s turret, with four .303 machine guns. I’ve seen many of these before, but it’s only when it’s no longer part of an aircraft and you’re standing a foot away from it, that you suddenly realize just how cramped it must have been. We’re not talking Cessna 152 cockpit cramped. Not even Ryanair squished. With cold weather flying gear and a chest mounted parachute the only part of your body that wouldn’t be physically pressed against the inside of the turret would be your hands. Suddenly you can imagine yourself there. And more questions come to mind. How would it clear a jammed gun? If I take my gloves off my hands will stick to any metal object I touch, because it’s all about -40c. Protect my hands and it’ll be like working while wearing boxing gloves. How long would I have to do this? Possibly (as the old skydiving joke goes) the rest of my life if we were under attack… I’ve never had an experience like that at a mega museum.

Support small aviation museums.

For every mega museum there’s probably about two dozen smaller ones, typically hiding in a couple of hangars at what was once a busy airfield. Even if there isn’t one near you, it’s worth checking out what’s nearby whenever you travel. The people who run these museums put their heart and soul into them, and deserve our support. So if you haven’t done so visit your local ones, and when you travel find out which ones will be on your way.

Thoughts from reading "Command and Control", a book about the history of nuclear weapons safety by Eric Schlosser.

While a comparison of the IOT with nuclear weapons might seem a little drastic, the IOT represents a fundamental change in how we use computers - for the first time we will be building networked computers into the physical devices that run our lives in such a way that we can't turn them off or ignore them. And it turns out that both the IOT and The Bomb have something in common: Both must work, but never go wrong. In both cases the goal 'must work' is fundamentally at odds with the goal 'never go wrong', which means that hard decisions are required.

The book has a a slightly odd structure, in that it alternates between a narrative describing the chaos caused by a dropped wrench in Damascus, AK, and a history of attempts to make the ownership of nuclear weapons safer. What's clear is just how hard it is take make complex systems both safe and reliable, and there are clear implications for the design of IOT systems:

1. Avoid optimistic assumptions about user behavior

Early bombs were built and engineered on the assumption that they would live in temperature controlled bunkers, be hung off an airplane once or twice a year and then refurbished after 7-10 years. But from around 1961 live weapons were habitually shuttled in circles around the world as part of the Airborne Alert strategy of keeping some nuclear armed aircraft aloft at all times. This led to a drastic increase in wear and tear on the bombs themselves. The lesson here is that once your IOT device ships you have no real control over how its used, so if - for example - you are mad enough to build an IOT controlled kettle you need to ask 'What's the worst thing that could possibly happen?' before you start selling them,

2. Will your IOT device fail safely?

Early Atomic bomb designers assumed that a fire would rapidly destroy the bomb's electronics and would then cause the conventional explosives that ignite the nuclear reaction to detonate in a uncoordinated way, thus destroying the bomb without a nuclear explosion. When they actually tested the electronic components in a fire they found out that as the solder melted and flowed across the circuit board it created new, temporary and highly disconcerting circuits that could plausibly result in a nuclear explosion. So if you're engineering an IOT device you need to ask yourself what kind of failure modes could it have? Are there scenarios where really bad things could happen? Don't make the mistake of assuming 'unlikely' and 'impossible' are the same - if your IOT product is successful you will ship millions of them, and they will be used until they physically stop working. You therefore have to assume it will continue to be used while dying or broken, and build in safeguards appropriately.

3. Security and safety must be built in - Retrofitting it doesn't work

In May 1957 a Mark 17 Hydrogen bomb being carried by a B-36 bomber was accidentally released over Sandia Labs in New Mexico after the navigator accidentally grabbed the manual bomb release handle during turbulence. As a consequence a remote controlled locking pin was added to prevent bombs being dropped accidentally.

Less than a year later the newly added pin caused an accident on a B-47 carrying a bomb from Savannah, GA to North Africa. After takeoff a warning light indicated that the newly installed safety device hadn't worked. In the interests of safety Captain Bruce Kulka was sent into the bomb bay to find and insert the pin. While fumbling around on top of the bomb the darkness Kulka inadvertently pulled the emergency jettison cable, with the result that - in a scene the people who've seen Dr Strangelove will find oddly familiar - he found himself sitting on a hydrogen bomb which in turn was sitting on the creaking thin sheet metal of the bomb bay doors. Captain Kulka made it back into the cockpit just in time to report the unfortunate departure of their 7,000lb Mark 6 bomb for its new home in Mars Bluff, SC.

This is a classic example of how trying to retrofit security and/or safety rarely works, and is subject to the law of diminishing returns, as 'extra' layers of security create weaknesses of their own.

4. Security and Reliability may be at odds with each other

One of the fundamental problems the designers of nuclear weapon systems face is the inherent conflict between reliability and security. Every time you add a safeguard to prevent the accidental use of a device you also make it slightly harder to use it in anger, especially as your opponent may exploit your security mechanism to render your weapon useless. So to launch an ICBM would require two people in the silo to turn keys while a third person remotely opened a fuel valve inside the missile. The third person makes it impossible to launch a missile without people in two locations deciding to, but also means that all the concrete, steel and security at the silo will become irrelevant if the communications link to the remote site is destroyed as there will be no way of launching the missile. So every time you add security you run the risk of reducing reliability. This principle applies to IOT devices, which also depend on networks of trusted counter parties to work.

Lessons for IOT from nuclear weapons design

1. You can't design your device in a vacuum.

A 'safe' IOT device will have been designed as part of a complete ecosystem, including all the back end systems and intermediaries. Realistic assumptions will be made about the potential for abuse and end-of-life behavior of the device. Because we are building physical devices which may last decades, issues such as the 2038 bug will need to be addressed upfront.

2. Safety measures need to be designed in, not abstracted away or left in the hands of third parties.

Early nuclear weapons had no security devices at all. The 'Little Boy' device dropped on Hiroshima would explode if it either came into contact with seawater or was violently decelerated. 'Fat Man', which was used on Nagasaki, was vulnerable to static electricity and especially lightning. Adding a combination lock or any other form of moveable physical security wouldn't have made either of these devices safer, which proves the point we made earlier.

Modern devices have a Permissive Action Link or 'PAL'. The whole point of the PAL is to make it impossible to use a device without it, but the PAL itself is built into the bomb.

Unless a series of authentication steps (such as combinations) and environmental factors are met the device will simply refuse to work. Even if you know the combination the device must still be attached to an airplane, then the air pressure must decrease, then the device must be released and fall a significant distance in order for the PAL to allow a detonation.

Bypassing a PAL has been described as "...about as complex as performing a tonsillectomy while entering the patient from the wrong end". Because the PAL has been designed from the very start on the assumption that somebody will tamper with it, trying to bypass it is a risky business, as it will cause a non-nuclear self destructive explosion if it detects an attempt to bypass it.

While I'm not about to advocate the use of explosive self destruct capability in consumer grade IOT devices, designers do need to address security from the very outset, by considering design choices and physical constraints that prevent malign use, such as using radio frequencies that aren't allowed but the device can still transmit on, or using a Linux distribution without removing absolutely all unneeded functionality.

This content originally appeared in my LinkedIn feed.

DB Cooper is in the news again, with the release of a Netflix series. Cooper has always interested me, as while spending a decade living in Northern California I spent much of my spare time skydiving at Byron, Lodi and Davis. Over the years I racked up six hours and fourteen minutes in freefall time and was also able to join the small number of people who have actually jumped from a 727, at the World Freefall Convention in 1996. So while I’m not going to claim to be an expert in hijacking, I can argue that my viewpoint isn’t totally uninformed.

For the west coast skydiving community DB Cooper is a semi-mythical figure with a strong Robin Hood vibe. The bedrock assumption was that he was an experienced jumper. Questioning the idea that he was competent would go about as well as mentioning the truth about The Man In Red in the presence of small children.

With hindsight this is really, really odd. While the public perceive skydivers to be a cross between The Dude from The Big Lebowski and Biggles, the truth is that they are usually smart, calculating people who think several steps ahead and plan things in detail. While a group of skydivers might look chaotic as they leave a plane, the reality is that everything is planned down to the second and the inch. You know exactly where you put your hands and feet at different stages of the exit. People even have specific jobs - I was a rear-rear-float. What looks like random chaos to outsiders is in fact just as carefully planned as the activities of a Premier League soccer team. Which makes the unwillingness to question DB Cooper’s competence really odd, as any experienced jumper planning it would have not made the dreadful social and fashion choices he did.

Faux Pas #1: Never ask someone if you can borrow one of their outfits in the middle of a soirée.

Experienced jumpers hate borrowing gear. Buying your own rig is the first thing you do when you finish training. It’s not that you’re afraid that borrowed gear won’t work - it’s that handles will be in slightly different places, and life is much simpler if they are always in exactly the same place when you reach for them, not two inches to the left or right. There’s also the issue of being dependent on somebody else’s stuff being available, and the risk that you might damage it.

What this means is that if an experienced jumper decided to do what DB Cooper did, the starting point of their plan would be to use their own rig. OK, maybe not their own gear, but obtaining a second rig that can’t be traced to you is not that hard if you are in the sport and know where to look. Asking the government to provide you with a parachute doesn’t make any sense, as you’d be telegraphing your plan to the authorities.

Let’s look at that plan for a second. If you ask the feds for a parachute the obvious concern is that they’d give you a non-functioning one. In practice I think people overestimate the risk of this. It would be hard enough to obtain one which works at minimal notice, never mind persuade a parachute rigger to sabotage somebody else’s rig and hand it to a man who showed up out of the blue and claimed to be from the government. But Cooper asked for two sets of gear, presumably to rule this out.

Asking for one parachute makes your intentions obvious, and starts a nationwide manhunt. Asking for two turns that into a North America wide hostage rescue situation, and means that every law enforcement agency within 2000 miles will be sitting, ready for a call, to pounce on anyone who parachutes from anything, anywhere.

So the obvious thing to do is obtain another rig before your flight and bring it aboard in a carry on. You can then bail out, leaving a suitably incoherent and psychotic ‘suicide note’. They’ll know you jumped, but only after the fact. They will be looking for a body, not a fugitive. The idea that an experienced jumper planning a hijacking wouldn’t think of this strikes me as absurd.

Faux Pas #2: Never wear slip-on shoes to a Jet Jump.

The second terrible fashion choice was his footwear. DB Cooper was observed to be wearing slip on shoes. In freefall everything which isn’t extremely firmly attached will flutter rapidly and violently. I once forgot to tuck in the end of the strap which kept my helmet on, and in 72 seconds it not only hurt like bejasus but managed to draw blood. Slip on shoes would be gone within a second. Any experienced jumper planning this would have opted for boots or shoes with really good ankle protection, especially as the chosen drop zone was rough terrain. So are we supposed to believe that he smuggled a pair of doc martins aboard, but didn’t think to bring his own rig?

Let’s also look at the choice of drop zone. The region he jumped into is about 50% trees. Wooded terrain sounds wonderful at first, but have you ever tried removing a parachute from a tree, at night, with no shoes? If you can’t hide the parachute you are in deep trouble. At dawn the helicopters that are part of the nationwide manhunt you’ve provoked will see it, and will know your location to within a couple of miles. Then there’s the fact that trees are dangerous to land in. Smokejumpers, who land in trees for living, have special clothing and bring equipment to escape from a tree when their parachute gets caught in it. So slip on shoes are, with hindsight, were the least of his sartorial problems.

Faux Pas #3: Never carry luggage that clashes with your outfit.

The third faux pas was that having been given the money, he was observed to tie the bag to himself and the rig with paracord or string. As I mentioned above, this is a recipe to be beaten to death by your own stuff on the way down. There’s also no guarantee that the bag itself wouldn’t disintegrate when it hits the brutal airflow you encounter when you leave a 727. So if you were planning on jumping out of a 727 with a large bag of someone else’s money you’d need a custom container that integrates properly with your gear, and is strong enough to withstand the forces you’ll encounter, while being capable of being carried out of a forest after landing. Once you owned such a bag you could use it as a carry on, to bring your own parachute on board. But instead we get a bizarre attempt to improvise. It’s the equivalent of turning up for a first date wearing a black plastic rubbish bag tied around the waist with string.

Just because you want to believe something, doesn’t mean it’s true.

Nobody will want to hear this, but the bottom line is that if you look at the DB Cooper story from the perspective of an experienced jumper it simply doesn’t make sense. While it’s clear he had some exposure to aviation, the truth of the matter is his plan was poorly thought through. We live in a culture where almost all entertainment portrays criminals as highly intelligent masterminds, invariably pursued by over-motivated detectives with out of control personal problems. This is not how real crime works. Dunning Kruger syndrome is as common in the criminal community as it is the rest of society, and we have a tendency to mistake “breathtakingly stupid, but original” for “audacious”.

People who have never been to the west coast of the US don’t understand how ridiculously big it is, and how easy it would be to vanish and never be found. When Steve Fossett disappeared the search found eight other aircraft before it found him. Once you understand this, the failure to find the remains of DB Cooper is not mysterious.

Here in Dublin the 21st century is actually happening! You can now get your fast food delivered by drone. But is this - like my late mother in law said about computers, or possibly me - ‘a passing fad’, or will it take off?

Drone deliveries face three major challenges. Two of these challenges are somewhat subjective, and easily explained, but the last one involves the laws of physics. In this article I argue that:

• A commercially successful drone delivery business is heavily dependent on location and environmental factors. Not just the weather. Other factors, such as population density and even wildlife come into play.

• There has yet to be a public backlash to drones, but is one plausible?

• The laws of physics, and specifically how they apply to parachutes, place limits on how safe a drone delivery system can be. There is an unavoidable level of risk to the public.

Who am I to say all this? In addition to far too many years working in the software industry I also have a US private pilots licence and parachute qualifications (450 jumps, 6 hours in freefall). So am I an expert? No! But neither can you completely discount what I say…

Drone Delivery is too dependent on environmental factors to be a reliable ‘rubber stamp’ business model.

Dublin is an odd location for a pioneer drone delivery service, yet we have one. The average wind speed is measured at around 6 m/s, or about 21 kph when measured at ground level. As you get higher the wind rapidly increases, so the winds aloft would easily be 50% more than at ground level. If you are a drone that can only move at 80kph, a 31 kph headwind is a real issue. In addition, the low level stream of air is thrown into chaos as it passes over buildings, trees and so on, much like a stream running over rocks. For this reason skydivers, and even sometimes airplanes, will avoid landing directly downwind of large obstacles. “Well, if it’s windy we just won’t go!” I hear you say… But remember: We’re trying to run a business here! A surplus of wind means a deficit of revenue.

Another aspect of Dublin is its unusual pattern of development. Dublin doesn’t ‘do’ high rise buildings. Instead we have miles and miles of suburbs, with duplex housing, gardens and so on. It’s more like Los Angeles than a normal European city, like Paris, London or Barcelona. This impacts the economics of drone delivery. The good news is that there are a lot of viable delivery sites. The bad news is that the catchment area for each drone delivery site is fairly small. So finding a market where drones will work means finding a sweet spot for housing density - dense enough to be viable, sparse enough that landing sites are plentiful. This may limit how clonable a drone delivery business is.

Aside from winds and population density, is there anything else we should worry about? Well, maybe I’m reaching here, but one aspect of Dublin life is that the central parts of the city are infested with seagulls. These are not nice creatures. They have a wingspan of up to 1.5m, are aggressive, and associate humans with food. For example, there’s a well known clip on youtube, showing a Dublin seagull walking into a convenience store and shoplifting a packet of crisps.

Seagulls also steal ice creams and chips, and in one recent incident that indicates they are starting to become more sophisticated, stole a politician’s wallet.

So far, we have yet to hear of any incidents of aerial piracy involving drones and seagulls, but surely it’s only a matter of time before the gulls figure out the drones are associated with food? As Australia has found, birds can and will change their behavior when they discover new food sources. What then?

The public attitude to drones could become hostile over the next decade.

Right now drone delivery is a novelty, like e-scooters were a few years ago. But we’re already starting to see pushback from communities in heavily overflown areas. The drones in question are far from silent, and impossible to ignore. They represent a classic example of what economists call an ‘externality’ - an indirect cost to the community that’s created by the operation of drones.

But there’s another, far more serious issue. Drones are a weapon of war. In fact, in Ukraine right now they are the weapon of war. According to Forbes, drones now destroy roughly two thirds of targets, and ‘targets’ in this case means ‘people’. The latest generation uses trailing fibre optic cables to avoid jamming, and it’s a matter of time before a 100% autonomous drone that hunts for targets in a specific area and then attacks them without any human intervention is deployed.

This leads to the question: Once the public finally understands how deadly drones are, how comfortable will they be with them flying overhead?

The laws of physics limit how safe a delivery drone service can be.

On 14th July, 2022 an urban drone delivery flight in Dublin went wrong. We know this because there’s an official accident report. The report reveals some fairly serious and fundamental limitations of drone delivery.

The planned flight involved a flight at a height of about 70m from the drone operator’s base to a destination roughly 1km away. On arrival, the plan was to descend to about 15m, and lower the payload on a line.

Instead, it lost one of its 8 propeller blades en route. This caused severe vibration that made continued flight impossible. The drone attempted to return to its base, but eventually gave up and deployed its emergency parachute.

All of this sounds innocuous, until you dig into the details:

Delivery drones are heavy enough to be a problem for people or things underneath them.

The drone has a maximum payload of 2.25kg. But in order to move this payload the maximum take off weight of the drone is 23.6kg, implying a minimum weight of 21.35kg, or 47 pounds. It’s enough weight to be a problem if it falls from a height. But surely the onboard parachute will save us?

Sadly, there are limits to how much a round parachute can slow something down…

If you want a tippy-toe soft landing you need to be using a ram air parachute, like the ones used by skydivers. This is totally impractical for a drone, especially one that’s concerned about failures at low altitude. The parachute used was round and had a diameter of 3m, which led to a final descent rate of just under 5m/sec, or 18kph. This is about as good as you can get, but it means that under an ‘ideal scenario’, a 23kg object will be descending at a speed equivalent to being dropped from around one meter, with about 221 joules of energy, which is considerably more than then 40 joules the oil industry considers safe. Making the parachute bigger could reduce the descent rate to an absolute minimum of 3.5m/s, but that’s still 141 joules. And this is the best case scenario.

The worst case scenarios are alarming.

The popular assumption is that the parachute is a sort of magical ‘get out of jail’ card for its user, be it a drone or a human. But over the last decade 25 skydivers in the US died in plane crashes, representing about 15% of fatalities. Why? Because things can go wrong much faster than people can act, or you can get into situations where there is no viable way to open the parachute before you make contact with the ground. In the photograph below, the drone’s parachute sits in the white tube under the yellow cap, with a pyrotechnic charge below. The assumption is that the drone will be more or less level and stationary when it's deployed.

Why does it need a pyrotechnic charge? Most parachutes need speed and time to open - a skydiver’s chute opens in about 3 seconds at a deployment speed of 120mph. The one on the drone uses pyrotechnics to open in around one second, even with no airspeed. This is another thing which may antagonize the public when they become aware of it.

In reality, there’s a fairly short period of time between a failure starting, and the situation becoming unfixable. If the drone is on its side when the pyrotechnics fire, the chute will open, but then swing sideways in a pendulum motion while still descending. If the drone was rotating rapidly, it could put a series of twists into the lines of the chute that prevent it from opening fully. Or there’s the worst case scenario, which is that the drone’s inverted, fires the chute straight down and then falls into it. Bear in mind, the starting point for this is an assumed altitude of only 15m. Now, obviously, the drone operators will have software that’s on a hair trigger to fire the pyros the moment things get odd, but even then we still have a 23kg object descending rapidly.

But what if something serious and unexpected happens? Like the herring gull from earlier gets fed up with crisps and attacks the drone? Or our drone hits another drone? Two drones approaching each other head on, at night, would have a closing speed of 160kph, and each would be motionless from the perspective of the other. So while avoidance is possible, it can’t be guaranteed. A midair collision could instantly render the drone inert, leaving it to hit the ground three seconds later at around 100kph. In a crewed aircraft the pilot is responsible for avoiding other people, but drones don’t appear to have any mechanism for ‘seeing’ what's in front of them and reacting. The current proposed solution in Ireland for avoiding collisions appears to be to give individual drone delivery companies a monopoly of use of the low level airspace being used, which is clearly neither scalable nor sustainable, and is already being challenged.

In the incident in question, the drone deployed its parachute, but lost a propeller blade, which then hit a man mowing his lawn with enough force to draw blood. It’s one thing to order something by drone, and then have it harm you or your property during a botched delivery. It’s totally another for random people minding their own business in their own back garden to be injured.

The detached blade. Note that it’s about a foot long.

Drones are not subject to the same safety rules as airplanes.

One thing which stands out in the report is the extent to which the entire drone sector is very like aviation a hundred years ago - the standards and rules we take for granted today don’t exist. In the case of the incident, the report found that the propeller blade in question was not supposed to be used in a coaxial configuration. The manufacturer’s web site stated ‘Polymer props for coaxial configuration are under testing. Please DO NOT run polymer props on coaxial frames’. Yet there it was, being flown! This is mind boggling for someone with a pilot’s license to read. When I sit in the cockpit of an airplane I can state with absolute certainty that every single aspect of it has been approved by the manufacturer, certified by the regulator, installed and maintained by people who are also certified by the regulator, and that we have the paperwork to prove every aspect of this. The idea that anyone would stick a non-standard propeller on a crewed aircraft and start flying low over inhabited areas is crazy.

But because this is a drone, all of this is OK in the eyes of the regulator. As they say in the report “The UA did not have a Certificate of Airworthiness or a Design Verification Report nor was it required to.”. This is because they were operating in the ‘specific’ category, according to the Irish Aviation Authority's drone regulations:

• ‘‘Open’ category – operations that present a low (or no) risk to third parties. Operations are conducted in accordance with basic and predefined characteristics and are not subject to any further authorisation requirements.

• ‘Specific’ category – operations that present a greater risk than that of the Open category, or where one or more elements of the operation fall outside the boundaries of the Open category. Operations will require an operational authorisation from the CAA [national Civil Aviation Authority], based on a safety risk assessment.

• ‘Certified’ category – operations that present an equivalent risk to that of manned aviation and so will be subjected to the same regulatory regime.’

Now you can, in some jurisdictions, modify aircraft or even build new ones by yourself, which are then classified as ‘experimental’. But experimental aircraft face serious restrictions. For example, the US ones, which prohibit flight over densely populated areas or ‘compensation for hire’, that prevent them from being used by a food delivery service. Drones are apparently being dealt with on a case-by-case basis, with the result that there is no guarantee that the one flying over your house is ‘certified’ - i.e. designed, built, maintained or operated to the standards the public have come to expect from crewed aviation.

Conclusion

When I started researching this I was expecting comedy. What I got was physics, and fairly alarming physics at that.

Even if you persuade the public to love drones, and devise a reproducible and viable business model, the bottom line is that in order to deliver a meaningful payload, you need to use a drone that weighs more than 20kg. When such a drone fails, the best we can expect is that it reaches the ground with an alarming amount of impact energy.

Is the government going to view such drone accidents as a ‘normal’ occurrence, in the same way that a collision with a Honda 50 delivering a burrito would be regarded as ‘normal?’ Or will it legislate the industry out of existence by insisting on high levels of public liability insurance or simply by banning it?

Source: ImageURL

From what I can tell the drone industry in Ireland is following all the rules and doing delivery as well as it can be done. But all it needs is one high profile accident, caused by one rogue vendor, in one distant city and the entire industry globally will be tarred with the same brush. Once this happens, prospective drone delivery vendors will have to go down the ‘Certified’ route, as regulating yourself and offering assurances will no longer be acceptable. But as anyone in aviation will tell you, trying to retroactively make something ‘certified’ is somewhere between hard and impossible, and it would usually be simpler to start again from scratch.